CVE-2024-47067: Alistgo Alist

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0.

Affected products

• Alistgo Alist: before 3.29.0 (fixed in 3.29.0)

Published 2024-09-30. Last modified 2026-06-17.